Managed Identity Sign-in Logs

OperationName	Description	Sample	Rule
any	Any record in this table with no specific result or signal bucket filter. Every record carries OperationName = "Sign-in activity"; detections pivot on field values, not a per-action discriminator.	Y	Y
Success	Record with ResultType 0: the managed identity's token acquisition completed successfully.	Y	N
Blocked-by-CA	Record with ResultType 53003 (or one of the further Conditional-Access-related block codes 53000, 53001, 53002, 50131, 50158, 50097): a Conditional Access policy returned a block decision for the managed identity's sign-in. Code 50158 (external security challenge not satisfied) can accompany either a passed or a failed challenge, so on its own it is not conclusive of a block.	N	N
Other	Record whose ResultType is not 0 or a Conditional-Access block code. The table's own column doc describes ResultType as Success-or-Failure; this bucket holds every other failure code.	N	N
Target application	Record carrying AppId or ResourceDisplayName: the application identifier and the resource the managed identity signed into.	Y	N
Conditional Access status	Record carrying ConditionalAccessStatus: the status of every Conditional Access policy related to the managed identity's sign-in.	Y	N

any: Sign-in record (AADManagedIdentitySignInLogs, any result)

Description

Any record in this table with no specific result or signal bucket filter. Every record carries OperationName = "Sign-in activity"; detections pivot on field values, not a per-action discriminator.

Example Sign-in Log Entry #

{
  "AADTenantId": "11111111-1111-1111-1111-111111111111",
  "Agent": {
    "agentType": "notAgentic",
    "agentSubjectType": "notAgentic"
  },
  "AppId": "b03f542d-bdd6-477f-a424-624b81305fc1",
  "AuthenticationContextClassReferences": [],
  "AuthenticationProcessingDetails": [
    {
      "key": "Legacy TLS (TLS 1.0, 1.1, 3DES)",
      "value": "False"
    },
    {
      "key": "Is Legacy Store Used",
      "value": "False"
    },
    {
      "key": "Is CAE Token",
      "value": "False"
    }
  ],
  "Category": "ManagedIdentitySignInLogs",
  "ClientCredentialType": "none",
  "ConditionalAccessAudiences": [],
  "ConditionalAccessPolicies": [],
  "ConditionalAccessPoliciesV2": "None",
  "ConditionalAccessStatus": "notApplied",
  "CorrelationId": "c088ded1-23dd-4b62-8cb4-fa2ebd4de855",
  "CreatedDateTime": "2026-07-25T16:10:17.557475Z",
  "DurationMs": "0",
  "Id": "a5c6d733-08f3-4642-8d6c-4663f6f45800",
  "LocationDetails": {
    "city": "",
    "state": "",
    "countryOrRegion": "",
    "geoCoordinates": {
      "latitude": 0.0,
      "longitude": 0.0
    }
  },
  "OperationName": "Sign-in activity",
  "OperationVersion": "1.0",
  "ResourceDisplayName": "Microsoft Graph",
  "ResourceGroup": "Microsoft.aadiam",
  "ResourceIdentity": "00000003-0000-0000-c000-000000000000",
  "ResourceOwnerTenantId": "f8cdef31-a31e-4b4a-93e4-5f571e91255a",
  "ResourceServicePrincipalId": "2e5ab30e-ae89-43c2-b130-0022f3d655a7",
  "ResultSignature": "SUCCESS",
  "ResultType": "0",
  "ServicePrincipalId": "bd7574b0-c942-42da-8fa3-2cf6d9a0142c",
  "ServicePrincipalName": "dw-signin-mi-f313ab",
  "UniqueTokenIdentifier": "M9fGpfMIQkaNbEZj9vRYAA"
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`event.outcome` (elastic rule field)	eq	`success`	16 rules	elastic
`azure_ad::user_type` (elastic rule field)	eq	`member`	10 rules	elastic
`EventType` (elastic rule field)	eq	`sign-in activity`	7 rules	elastic
`azure_ad::app_id` (elastic rule field)	eq	`29d9ed98-a469-4536-ade2-f981bc1d605e`	5 rules	elastic
`azure_ad::resource_id` (elastic rule field)	eq	`00000002-0000-0000-c000-000000000000`	3 rules	elastic
`azure_ad::resource_id` (elastic rule field)	in	`00000003-0000-0000-c000-000000000000`	4 rules	elastic
`security_result.action (Chronicle)`	eq	`ALLOW`	4 rules	chronicle
`azure_ad::authentication_protocol` (elastic rule field)	eq	`devicecode`	3 rules	elastic
`azure_ad::authentication_requirement` (elastic rule field)	eq	`singlefactorauthentication`	3 rules	elastic
`azure_ad::user_principal_name` (elastic rule field)	is_not_null		3 rules	elastic
`azure.activitylogs.properties.authentication_protocol` (elastic rule field)	eq	`devicecode`	2 rules	elastic
`azure.signinlogs.identity` (elastic rule field)	is_not_null		2 rules	elastic
`azure.signinlogs.properties.authentication_details.authentication_method` (elastic rule field)	eq	`password`	2 rules	elastic
`azure.signinlogs.properties.original_transfer_method` (elastic rule field)	eq	`devicecodeflow`	2 rules	elastic
`azure.signinlogs.properties.token_issuer_type` (elastic rule field)	eq	`azuread`	2 rules	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Entra ID Sharepoint or OneDrive Accessed by Unusual Client source medium: Identifies when an application accesses SharePoint Online or OneDrive for Business for the first time in the tenant within a specified timeframe. This detects successful OAuth phishing campaigns, illicit consent grants, or compromised third-party applications gaining initial access to file storage. Adversaries often use malicious OAuth applications or phishing techniques to gain consent from users, allowing persistent access to organizational data repositories without traditional credential theft.T1078, T1078.004, T1098, T1098.001, T1213, T1213.002
Entra ID OAuth Device Code Flow with Concurrent Sign-ins source high: Identifies Entra ID device code authentication flows where multiple user agents are observed within the same session. This pattern is indicative of device code phishing, where an attacker's polling client (e.g., Python script) and the victim's browser both appear in the same authentication session. In legitimate device code flows, the user authenticates via browser while the requesting application polls for tokens - when these have distinctly different user agents (e.g., Python Requests vs Chrome), it may indicate the code was phished and redeemed by an attacker.T1078, T1078.004, T1528, T1566, T1566.002
Entra ID OAuth Device Code Sign-in to Azure AD Graph Enumeration source high: Correlates a successful Entra ID device-code sign-in to the legacy Azure AD Graph audience (00000002-0000-0000-c000-000000000000) from an unmanaged device with directory enumeration against graph.windows.net by the same user within a short window. Device-code phishing is the dominant OAuth phishing variant against Microsoft tenants: the adversary initiates the flow, relays the user-facing code to the victim, and on redemption walks away with an access or refresh token bound to the targeted resource without ever handling the user's password or MFA factor. When the redeemed audience is AAD Graph and the redeeming device is unmanaged, the follow-on Graph traffic is the compromised cloud account being used by the attacker, not by the user. This rule fires when that token is immediately turned around against the directory under the same identity to read user, group, service principal, application, role assignment, directory object, policy, OAuth permission grant, or tenant detail collections.T1069, T1069.003, T1078, T1078.004, T1087, T1087.004

Show 17 more (31 total) on the rules page

Splunk #

Detect Distributed Password Spray Attempts source: This analytic employs the 3-sigma approach to identify distributed password spray attacks. A distributed password spray attack is a type of brute force attack where the attacker attempts a few common passwords against many different…T1110, T1110.003
Azure AD Multi-Source Failed Authentications Spike source: The following analytic detects potential distributed password spraying attacks in an Azure AD environment. It identifies a spike in failed authentication attempts across various user-and-IP combinations from multiple source IPs and…T1110, T1110.003, T1110.004, T1586, T1586.003
Azure AD User Consent Denied for OAuth Application source: The following analytic identifies instances where a user has denied consent to an OAuth application seeking permissions within the Azure AD environment. This detection leverages Azure AD's audit logs, specifically focusing on user consent…T1528

Kusto #

Lumen TI IPAddress in IdentityLogonEvents source medium: This query maps Lumen IP indicators of compromise (IOCs) from threat intelligence (TI), by searching for matches in Azure AD sign-in logs.T1071

YARA-L #

Entra ID Admin Login Activity to Uncommon MS Cloud Apps source medium: Detects Azure AD admin login activity to apps other than a defined list of first party MS Cloud Apps. Note that Azure Active Directory PowerShell and custom Azure apps are not in this list by defaultT1078, T1078.004
Microsoft Entra ID Device code phishing attack source high: Detects strong indicators of a successful device code phishing attack.T1566
Entra ID Login Activity to Azure AD PowerShell Application source medium: Logins to Azure AD PowerShell app can have legitimate purposes, but are also abused to gain access to user information. Programatic access to Azure AD should generally be through other apps

Show 2 more (5 total) on the rules page

Panther #

Azure Device Code Authentication with Broker Client source medium: Detects device code authentication using the Microsoft Broker Client application, which may indicate Primary Refresh Token (PRT) abuse. Device code flow allows adversaries to trick users into entering codes on attacker-controlled applications. When combined with Microsoft Broker Client (app ID 29d9ed98-a469-4536-ade2-f981bc1d605e), this may indicate PRT theft or replay attacks that bypass MFA and Conditional Access policies.T1078, T1078.004, T1550, T1550.001, T1566, T1566.002
Azure Excessive Account Lockouts source high: Detects high volumes of failed Microsoft Entra ID sign-in attempts resulting in account lockouts, indicating potential brute-force credential attacks such as password spraying, password guessing, or credential stuffing. When adversaries repeatedly attempt authentication with incorrect credentials, Entra ID Smart Lockout policies trigger account lockouts (error code 50053).T1110, T1110.001, T1110.003, T1110.004
Azure Many Failed SignIns source medium: This detection looks for a number of failed sign-ins for the same ServicePrincipalName or UserPrincipalNameT1078, T1110

Show 8 more (11 total) on the rules page

Success: Successful sign-in

Description

Record with ResultType 0: the managed identity's token acquisition completed successfully.

Example Sign-in Log Entry #

{
  "AADTenantId": "11111111-1111-1111-1111-111111111111",
  "Agent": {
    "agentType": "notAgentic",
    "agentSubjectType": "notAgentic"
  },
  "AppId": "b03f542d-bdd6-477f-a424-624b81305fc1",
  "AuthenticationContextClassReferences": [],
  "AuthenticationProcessingDetails": [
    {
      "key": "Legacy TLS (TLS 1.0, 1.1, 3DES)",
      "value": "False"
    },
    {
      "key": "Is Legacy Store Used",
      "value": "False"
    },
    {
      "key": "Is CAE Token",
      "value": "False"
    }
  ],
  "Category": "ManagedIdentitySignInLogs",
  "ClientCredentialType": "none",
  "ConditionalAccessAudiences": [],
  "ConditionalAccessPolicies": [],
  "ConditionalAccessPoliciesV2": "None",
  "ConditionalAccessStatus": "notApplied",
  "CorrelationId": "c088ded1-23dd-4b62-8cb4-fa2ebd4de855",
  "CreatedDateTime": "2026-07-25T16:10:17.557475Z",
  "DurationMs": "0",
  "Id": "a5c6d733-08f3-4642-8d6c-4663f6f45800",
  "LocationDetails": {
    "city": "",
    "state": "",
    "countryOrRegion": "",
    "geoCoordinates": {
      "latitude": 0.0,
      "longitude": 0.0
    }
  },
  "OperationName": "Sign-in activity",
  "OperationVersion": "1.0",
  "ResourceDisplayName": "Microsoft Graph",
  "ResourceGroup": "Microsoft.aadiam",
  "ResourceIdentity": "00000003-0000-0000-c000-000000000000",
  "ResourceOwnerTenantId": "f8cdef31-a31e-4b4a-93e4-5f571e91255a",
  "ResourceServicePrincipalId": "2e5ab30e-ae89-43c2-b130-0022f3d655a7",
  "ResultSignature": "SUCCESS",
  "ResultType": "0",
  "ServicePrincipalId": "bd7574b0-c942-42da-8fa3-2cf6d9a0142c",
  "ServicePrincipalName": "dw-signin-mi-f313ab",
  "UniqueTokenIdentifier": "M9fGpfMIQkaNbEZj9vRYAA"
}

Blocked-by-CA: Sign-in blocked by Conditional Access

Description

Record with ResultType 53003 (or one of the further Conditional-Access-related block codes 53000, 53001, 53002, 50131, 50158, 50097): a Conditional Access policy returned a block decision for the managed identity's sign-in. Code 50158 (external security challenge not satisfied) can accompany either a passed or a failed challenge, so on its own it is not conclusive of a block.

Other: Sign-in with another recorded result

Description

Record whose ResultType is not 0 or a Conditional-Access block code. The table's own column doc describes ResultType as Success-or-Failure; this bucket holds every other failure code.

Target application: Sign-in naming a target application

Description

Record carrying AppId or ResourceDisplayName: the application identifier and the resource the managed identity signed into.

Example Sign-in Log Entry #

{
  "AADTenantId": "11111111-1111-1111-1111-111111111111",
  "Agent": {
    "agentType": "notAgentic",
    "agentSubjectType": "notAgentic"
  },
  "AppId": "b03f542d-bdd6-477f-a424-624b81305fc1",
  "AuthenticationContextClassReferences": [],
  "AuthenticationProcessingDetails": [
    {
      "key": "Legacy TLS (TLS 1.0, 1.1, 3DES)",
      "value": "False"
    },
    {
      "key": "Is Legacy Store Used",
      "value": "False"
    },
    {
      "key": "Is CAE Token",
      "value": "False"
    }
  ],
  "Category": "ManagedIdentitySignInLogs",
  "ClientCredentialType": "none",
  "ConditionalAccessAudiences": [],
  "ConditionalAccessPolicies": [],
  "ConditionalAccessPoliciesV2": "None",
  "ConditionalAccessStatus": "notApplied",
  "CorrelationId": "c088ded1-23dd-4b62-8cb4-fa2ebd4de855",
  "CreatedDateTime": "2026-07-25T16:10:17.557475Z",
  "DurationMs": "0",
  "Id": "a5c6d733-08f3-4642-8d6c-4663f6f45800",
  "LocationDetails": {
    "city": "",
    "state": "",
    "countryOrRegion": "",
    "geoCoordinates": {
      "latitude": 0.0,
      "longitude": 0.0
    }
  },
  "OperationName": "Sign-in activity",
  "OperationVersion": "1.0",
  "ResourceDisplayName": "Microsoft Graph",
  "ResourceGroup": "Microsoft.aadiam",
  "ResourceIdentity": "00000003-0000-0000-c000-000000000000",
  "ResourceOwnerTenantId": "f8cdef31-a31e-4b4a-93e4-5f571e91255a",
  "ResourceServicePrincipalId": "2e5ab30e-ae89-43c2-b130-0022f3d655a7",
  "ResultSignature": "SUCCESS",
  "ResultType": "0",
  "ServicePrincipalId": "bd7574b0-c942-42da-8fa3-2cf6d9a0142c",
  "ServicePrincipalName": "dw-signin-mi-f313ab",
  "UniqueTokenIdentifier": "M9fGpfMIQkaNbEZj9vRYAA"
}

Conditional Access status: Sign-in recording a Conditional Access status

Description

Record carrying ConditionalAccessStatus: the status of every Conditional Access policy related to the managed identity's sign-in.

Example Sign-in Log Entry #

{
  "AADTenantId": "11111111-1111-1111-1111-111111111111",
  "Agent": {
    "agentType": "notAgentic",
    "agentSubjectType": "notAgentic"
  },
  "AppId": "b03f542d-bdd6-477f-a424-624b81305fc1",
  "AuthenticationContextClassReferences": [],
  "AuthenticationProcessingDetails": [
    {
      "key": "Legacy TLS (TLS 1.0, 1.1, 3DES)",
      "value": "False"
    },
    {
      "key": "Is Legacy Store Used",
      "value": "False"
    },
    {
      "key": "Is CAE Token",
      "value": "False"
    }
  ],
  "Category": "ManagedIdentitySignInLogs",
  "ClientCredentialType": "none",
  "ConditionalAccessAudiences": [],
  "ConditionalAccessPolicies": [],
  "ConditionalAccessPoliciesV2": "None",
  "ConditionalAccessStatus": "notApplied",
  "CorrelationId": "c088ded1-23dd-4b62-8cb4-fa2ebd4de855",
  "CreatedDateTime": "2026-07-25T16:10:17.557475Z",
  "DurationMs": "0",
  "Id": "a5c6d733-08f3-4642-8d6c-4663f6f45800",
  "LocationDetails": {
    "city": "",
    "state": "",
    "countryOrRegion": "",
    "geoCoordinates": {
      "latitude": 0.0,
      "longitude": 0.0
    }
  },
  "OperationName": "Sign-in activity",
  "OperationVersion": "1.0",
  "ResourceDisplayName": "Microsoft Graph",
  "ResourceGroup": "Microsoft.aadiam",
  "ResourceIdentity": "00000003-0000-0000-c000-000000000000",
  "ResourceOwnerTenantId": "f8cdef31-a31e-4b4a-93e4-5f571e91255a",
  "ResourceServicePrincipalId": "2e5ab30e-ae89-43c2-b130-0022f3d655a7",
  "ResultSignature": "SUCCESS",
  "ResultType": "0",
  "ServicePrincipalId": "bd7574b0-c942-42da-8fa3-2cf6d9a0142c",
  "ServicePrincipalName": "dw-signin-mi-f313ab",
  "UniqueTokenIdentifier": "M9fGpfMIQkaNbEZj9vRYAA"
}

Managed Identity Sign-in Logs

any: Sign-in record (AADManagedIdentitySignInLogs, any result)

Description

Example Sign-in Log Entry #

Common Indicators #

Related events #

Detection Rules #

Elastic #

Splunk #

Kusto #

YARA-L #

Panther #

Success: Successful sign-in

Description

Example Sign-in Log Entry #

Blocked-by-CA: Sign-in blocked by Conditional Access

Description

Other: Sign-in with another recorded result

Description

Target application: Sign-in naming a target application

Description

Example Sign-in Log Entry #

Conditional Access status: Sign-in recording a Conditional Access status

Description

Example Sign-in Log Entry #

References #